An incorrect authorization vulnerability in Vaultwarden versions prior to 1.35.5 allows authenticated attackers to perform unauthorized actions, threatening system integrity and availability.

The software is susceptible to CWE-863 (Incorrect Authorization), where an authenticated user can bypass security checks to perform operations that should be restricted. This vulnerability stems from improper validation of authorization tokens or permissions during authenticated sessions.

With a CVSS score of 8.1 (High), this vulnerability presents a substantial risk to the integrity and availability of the password management server. Unauthorized modification or disruption of service can lead to significant operational downtime and compromise the security of stored credentials managed by the platform.

Immediate Action: Update Vaultwarden to version 1.35.5 or later to apply the necessary authorization fixes.

Proactive Monitoring: Monitor server logs for unauthorized API calls or unexpected errors associated with user session tokens.

Compensating Controls: Ensure that the server is hosted within a secure, segmented network and limit administrative access to authorized personnel only.

Public Exploit Available: No (No confirmed public exploit exists in curated sources).

Although there is no current evidence of active exploitation, the nature of the vulnerability in a password management component necessitates immediate attention. Update to version 1.35.5 promptly to close the authorization gap and protect the sensitive data handled by the Vaultwarden instance.